[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <2026111052-spectator-legwarmer-4c1e@gregkh>
Date: Tue, 10 Nov 2026 16:52:41 -0500
From: Greg KH <gregkh@...uxfoundation.org>
To: Nakashima Seiichi <s-nakashima@....biglobe.ne.jp>
Cc: kernel-hardening@...ts.openwall.com,
linux-security-module@...r.kernel.org
Subject: Re: [Case Study] CVE-2024-0582: Why We Need a Standard for CVE
Emergency Mitigation
On Wed, Nov 11, 2026 at 06:28:39AM +0900, Nakashima Seiichi wrote:
> The case study demonstrates the gap between "technically possible"
> and "operationally scalable." With a standardized framework, the
> mitigation could have started on CVE publication day instead of
> waiting ~2.5 months for the distro patch.
There was a working patch before the CVE was issued, so who is waiting 2
1/2 months for anything?
Also, remember we are issuing about 55 CVEs per day right now, who is
going to do all of this review and "mitigation" for all of those
entries? That's almost 2 per hour, 24 hours a day. Do you have the
free tokens to burn on that?
And again, why? You have a fix. Given to you for free. Just apply it.
good luck!
greg k-h
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
